Identity as a service (IDaaS) outsources identity management to a hosted provider. The provider manages user identities, issues access tokens, and can handle signing-key protection and rotation, while the API validates tokens and enforces permissions. section 4.4 section 8.4
Use IDaaS to reduce the risks of implementing authentication yourself, but retain responsibility for integration:
- Choose a standard provider such as Okta, Auth0, AWS Cognito, Curity, Authlete, or Microsoft Entra. section 4.4 section 8.4
- Validate issuer, audience, signature, algorithm, and token lifetime correctly before granting API access. section 4.4 section 8.2
- Prefer an external OpenID Connect provider; if outsourcing is unavailable, consider self-hosting Keycloak rather than building identity infrastructure from scratch. section 8.2 section 8.4
Auth0-backed API
A FastAPI service can use Auth0 with the authorization code flow. Auth0 authenticates the user and issues a JWT; the API reads the provider's OpenID Connect discovery metadata, validates the access token, and applies its permissions to protected endpoints. section 8.4 section 8.2
Figure 4.3 An authentication system manages users’ identities, credentials, and access permissions. When a user logs in, they get back an API access token with specific permissions.
Use the authentication-system diagram to connect identity and credentials with the scoped API access token returned after login. section 4.4
